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B. Direct and reverse reconciliation protocols 
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We introduce new quantum key distribution protocols us- 
ing quantum continuous variables, that are secure against in- 
dividual attacks for any transmission of the optical line be- 
tween Alice and Bob. In particular, it is not required that 
this transmission is larger than 50 %. Though squeezing or 
entanglement may be helpful, they are not required, and there 
is no need for quantum memories or entanglement purifica- 
tion. These protocols can thus be implemented using coherent 
states and homodyne detection, and they may be more effi- 
cient than usual protocols using quantum discrete variables. 



I. INTRODUCTION 
A. Coherent QKD protocols 

In the presently very active field of continuous variable 
quantum information processing, a stimulating question 
is whether quantum continuous variables (QCV) may 
provide a valid alternative to the usual "single photon" 
quantum key distribution (QKD) schemes. Many recent 
proposals to use QCV for QKD (for a short review see 
0) are based upon the use of "non-classical" light beams, 
such as squeezed light, or entangled pairs of light beams. 
We have shown recently [Q that there is actually no need 
for squeezed light : an equivalent level of security may be 
obtained by simply generating and transmitting random 
distributions of coherent states. More precisely, we have 
shown in (l) that a whole family of secure protocols can be 
obtained by using either coherent states, squeezed states, 
or entangled EPR beams, provided that the transmission 
of the line is larger than 50% (i.e. the losses are less than 
3 dB). The security of these protocols is related to the 
no-cloning theorem ffijl, and non-classical features like 
squeezing or EPR correlations have no influence on the 
achievable secret key rate. The 3dB loss limit of these 
cryptography protocols makes their security demonstra- 
tion quite intuitive, but there exist in principle multiples 
ways for Alice and Bob to go beyond this limit, using e.g. 
entanglement purification 

In this paper we present new protocols that are secure 
for any value of the line transmission. The basic idea is 
to use reverse reconciliation protocols, that is, Alice will 
try to guess what was received by Bob, rather than Bob 
trying to guess what was sent by Alice. In that case, Alice 
can always guess better than the eavesdropper Eve: this 
is the basic reason for the security of these new protocols. 



In the first step of a generic QKD protocol, Alice pre- 
pares a quantum state and sends it to Bob, who makes a 
measurement on this state. Alternatively, Alice and Bob 
may share two EPR-correlated systems, and they both 
make measurement on their parts. In order to warrant 
security, Alice and Bob must randomly choose to use dif- 
ferent measurement basis, and the transmitted data will 
be significant only when their basis are compatible. Af- 
ter the quantum exchange, they have thus to agree on a 
common measurement basis, and discard the wrong mea- 
surements. At the end of this step, Alice and Bob (and 
the potential eavesdropper Eve) know a set of correlated 
measurements, that we will call the "key elements" . 

As a second step, Alice reveals some randomly cho- 
sen samples of the data that she sent, and Bob reveals 
his corresponding measurements. These samples allow 
them to measure some relevant parameters of the quan- 
tum channel, e.g. the error rate and the transmission, 
that is called "channel gain" for QCV protocols. Know- 
ing the correlations between their key elements, Alice 
and Bob can evaluate the amount of information they 
share (Iab), and the information the eavesdropper Eve 
can have about their values (Iae and I be)- Therefore 
they can evaluate the size of the secret key they will gen- 
erate at the end of the protocol. If Eve knows too much, 
the size of this secret key will be 0, and Alice and Bob 
will abort the protocol at this step. 

Now comes the crucial step of reconciliation, where Al- 
ice and Bob will use classical communications to extract a 
common key from their correlated key elements, revealing 
as little information as possible to a third party ignoring 
these key elements. This step usually uses parity-based 
algorithms like Cascade. There are actually two main 
options for doing the reconciliation 

Direct Reconciliation (DR). Alice sends correction in- 
formation and Bob corrects his key elements to have the 
same values as Alice. Alice knows from the previous step 
the minimum amount of information she's got to reveal 
at this step. If the reconciliation protocol is perfect, it 
keeps Iab — Iae constant. At the end of this step, Alice 
and Bob know a common bit string of length Iab , and 
Eve knows Iae bits of this string (slightly more if the 
reconciliation protocol is not perfect). It will provide a 
useable secret key if Iab — Iae > at the beginning. 
We call this "direct reconciliation" (DR) because Bob is 
reconstructing what was sent by Alice, and the classical 
information flow at this step has the same direction as 
the initial quantum information flow. 
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Direct reconciliation is quite intuitive, and it was used 
in the coherent state QCV protocol that we proposed 
recently jjj. However, it is not secure as soon as the 
quantum channel efficiency falls below 50%. Intuitively, 
Eve could simulate the losses by a beam splitter and look 
one output port of this beamsplitter. It seems obvious 
that, if she keeps the biggest part of the beam sent by 
Alice (i.e. if she simulate losses higher than 50%), she 
can extract more information from this beam than Bob 
(Iae > Iab), thus forbidding any secret key generation. 
This limitation is actually not specific to QCV : a "di- 
rect" version of BB84 would be a protocol where Bob 
would try to fill the "empty slots" where he did not get 
any photon. It's straightforward to show that this pro- 
tocol only works when the losses are smaller than 3 dB. 

Reverse Reconciliation (RR). We will thus consider 
"reverse" reconciliation (RR) protocols, where Bob sends 
correction information and Alice corrects her key ele- 
ments to have the same values as Bob. Since Bob gives 
the correction information (also to Eve), this type of rec- 
onciliation keeps Iab ~ I be constant, and will provide a 
useable key if Iab — I be > 0. We call it "reverse recon- 
ciliation" (RR) because Alice adapts herself to what was 
received by Bob. 

In a noiseless BB84 with finite line transmission, this 
step corresponds to Bob giving to Alice his "empty slots" 
where he did not get any photon, and Alice removing the 
bits she sent at these slots to have the same key. Obvi- 
ously it is also possible to make a reconciliation protocol 
using two way communications, but it can be shown || 
that reverse reconciliation is optimum for a coherent state 
protocol when there is no excess noise in the transmission 
line (see below). Therefore two- ways protocols will not 
be considered further in the present paper. 

Finally, the last step of a practical QKD protocol is 
that Alice and Bob perform privacy amplification to filter 
out Eve's information. Since this step is based on an 
evaluation of the amount of information collected by Eve 
on the reconciled key, a crucial requirement is to get a 
bound on Iae for DR, and on Ib e for RR. For a coherent 
state protocol, the DR bound was given in rcf. 0], and 
leads to a security limit for a 50% line transmission as 
said above. We will now establish the RR bound, and we 
will show that it is not associated with a minimum value 
of the line transmission. 



II. ENTANGLING CLONER 

A. Definition 

To eavesdrop a reverse reconciliation scheme, as de- 
scribed above, Eve needs to guess the results of Bob's 
measurement. We will call entangling doner a system 
allowing her to do so, because this kind of system can be 
described a doner creating two quantum-correlated out- 
put: Eve keeps one of them and sends the other to Bob. 



Let (xi n , pi n ) be the input quadratures of the entangling 
doner and (xb,Pb)i (xe,Pe) the quadratures of its two 
outputs. A good entangling doner should minimize the 
conditionnal variances J7[ V XB \ XE and V PB \ PE - 

Alice and Bob should assume Eve uses the best possible 
entangling doner, knowing the Alice-Bob channel quality. 
This channel can be described by 

Xb = 9x{Xin +B X ) (1) 
PB = 9p (Pin +B P ), (2) 

with (No is the shot noise variance) 

(4,) = (Pin) = VN > No (3) 

(BlJ ee Xx , p N (4) 
(x in B x ) = (p in B p ) = (5) 



B. Heisenberg inequalities on Alice and Eve's 
conditional variances 

For reverse reconciliation protocols, Alice needs to 
evaluate xb- Her estimator can be noted ax a, with 
a G R . Eve's estimator for ps will be epE- Their error 
will be 



XB\A.a = Xb - OLXA 
PB\E,e =PB~ ep E - 



(0) 

(7) 



The commutator [xb\a,ciiPb\e,e] of these two quanti- 
ties is then equal to 

[xb-,Pb] - a [xa,Pb] -£ [xb,Pe] +ue [xa,Pe] ■ (8) 
oo o 

We have therefore 

[xB\A,a->PB\E, s ] = [xB,Pb] (9) 



The conditional variances obey by definition the following 
relations : 



V XB \ XA = mm{^||A,a)} 

V Pb\pe = m ™{(pB\E,e)} 

and equation ( |l0| ) leads to 

V XB \ XA V PB \ PE > N , i.e. V PB \ PE > 



A 2 
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(11) 
(12) 

(13) 



By exchanging the roles of x and p one obtains similarly 



V, 



p B \pA^X B \x 



> N' i.e. V, 



x B \ Xl 



> 



N 2 o 



V, 



Pb\pa 



(14) 



These inequalities mean that Alice and Eve cannot 
jointly know more about Bob's field than allowed by the 
Heisenberg principle. 
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C. Alice's conditional variance 



We have then 



If Alice creates the held (xi n ,pi n ), we can write 

Xin = x A + A x (15) 
p in =PA + A p (16) 

where xa (pa)is Alice's best estimation of x- m (j>i n ) and 

(Al) = {AD = sN (17) 

where s is the amount of squeezing used by Alice to gen- 
crate this held. We have then 
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The correlation coefficients are equal to 

if a) =(V- s)No 
(p 2 b) =G p (V + x p )No 
(PaPb) =9p(p A )> 



(18) 



(19) 
(20) 
(21) 



and allow us to calculate Alice's conditional variance on 
Bob's measurement : 



V. 



Pb \Pa 



(Pi) 



(paPbY 
(Pi) 



GpVNo + GpXpN 
-G p VNo + GpsNo 
Gp{x P + s)N Q 



(22) 



A similar calculation leads to the symmetric relation 

V Xb{xa = G x ( Xx + s)N (23) 

These equations and the constraint (18|) on the squeezing 
give finally 

VpnlPA > V PB \PA,r*in = Gp{Xp + y)N (24) 
Vx B \x A ^ V x B \x A ,mm = G x (x x + J?) N (25) 



D. Eve's conditional variance 

The output-output correlations of an entangling 
doner, described e.g. by V PB \ PE , should only depend on 
the density matrix of the field (xi n ,pi n ) at its input, and 
not on the way this field was built. The inequality Jl3| ) 
has thus to be fulfilled for every physically allowed value 
01 V XB \ XA , given the density matrix of the field ( 

^in ) Pin ) • 

If we look for a boundary to Eve's knowledge by using 
eq.(|l^), we we have thus to use the tightest limit on 
V XB \ XA , that is S iven b y Vx B \xA,mm according to 



Obviously the same reasoning holds for V % 
corresponding tightest limit Vp B \ PA ^ 



Pb I Pa 



with the 



Vx B \x B — ^cb |a;£;,min 



No 



and, similarly 



Vp B \p E ^ *Pb\pe, min 



Gp{Xp + I IV) 



N 

G x ( Xx + l/V) 



(26) 



(27) 



E. Implementation 

In a practical QKD scheme Alice and Bob will give 
the same roles to x and p. Assuming therefore that G x = 
G p = G and Xx — Xp — X; the two bounds (|6[ ^?J) reduce 
to a single one, and it is possible to explicitly describe an 
entangling doner achieving this limit. We will consider 
here only the case where G < 1, but the limit is tight 
for any G. The entangling doner can then be sketched 
as follows : Eve uses a beamsplitter with a transmission 
G to split up part of the Alice-Bob transmitted signal, 
and she injects into the other input port a field El, with 
the right variance to induce a noise of variance GxNq at 
Bob's end. One has therefore: 



<4t> 



G X Nq 
1-G 



(fit) 



G X Np 
1-G 



(28) 



Eve should know the maximum about this injected field 
El, and will therefore use an half-pair of EPR-correlated 
beams, so that she does perform an "entangling" attack. 
We can then write 



XEl — ^known ~r X un k noW n 



(29) 



where Xknown stand for Eve's best estimation of Xei, 
given by the measure of its brother-beam, and cc U nknown 
stand for the noise she cannot know. We have 



(t 2 \ = 

\ unknown/ 



N 2 (1 - G)N 



b Ell 



G X 



(•^known) i[ X El) (^unknown) 



(30) 
(31) 



Eve also use an output port of the beamsplitter to 
measure the field E2, which gives her information about 
the input field : 



XE2 = gXEl - \/l - Gx w 



(32) 



She can cancel a part of the noise induced by El by 
substracting the part proportional to iknown- Thus she 
knows 



X E2 — 5^unknown VI GX[ T 

We also have 



xb = gx-m + Vl - Gxei- 



(33) 
(34) 
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where Eve already knows the part proportional to Xknown, 
injected with xei and she only needs to guess 



from x' E2 - We have therefore 



(35) 



(36) 



The calculation of the quantities (x^), (x E2 ), ( x 'e2 x 'b) 
lead straightforwardly to the conditional variance : 



" G X + G/V 



,min 



(37) 



showing that the entangling doner does reach the lower 
limit of (§|, |7|). 



III. REVERSE CRYPTOGRAPHY 



B. Secret information rates 

The conditions (Q) can directly be translated into an 
information rate by using Shannon's formula: 



1 , (4) 

1b A = -z log 2 -r 

^ Vb\A 

1 (x 2 b) 

I B e = ^log 2 > 



v. 



B\E 



(45) 
(46) 



The secret information rate, for a reverse reconciliation 
protocol is therefore 



at j j 1 , V B\E 

AI = I B A - Ibe = - log 2 — — 

2 Vb\A 

A/ = ^ l0g2 (G X+ f)(Gx + G.s) 



(47) 
(48) 



A. Tolerable noise 



C. High-modulation limit 



In a reverse quantum cryptography protocol, Eve's 
power is limited b y the values of V XB \ XEmin and 
^pslps.min given by (|2(], ^). In the following, we will 
assume that a "perfect" Eve is able to reach that limit: 



v, 



No 



x b F£,mm 



Vn 



G P (Xp + 1/V) 
N 



PB|PE ' mm G x ( Xx + l/V) 
Reverse cryptography is possible when 



\xe ^ V x 



;\xa 



or V Pb\pe > V Pb\pa 



(38) 
(39) 



(40) 
(41) 



Combining equations (B2|, |23|) and 
tions become 



3), the above condi- 



(G xXx ~\~ G x s)(GpXp 



G., 



< 1 



(G P Xp + G p s){G xX x + —)<!. 



(42) 
(43) 



These inequalities give the general conditions for the se- 
curity of a reverse reconciliation protocol. For simplicity 
reasons, we will assume in the following everything is 
symmetric in (x,p), i.e. G x — G p — G and \x — X P = X-, 
so that these conditions simplify into: 



(Gx + Gs)(G X + G/V) < 1. 



(44) 



Any experimental implementation of this protocol should 
however estimate these parameters from statistical tests, 
which are likely not to be exactly symmetric. 



At the high modulation limit, V — > oo, and for any 
squeezing s the condition (jij) becomes 



G X (Gx + Ga) < 1 
(Gx) 2 + Gs(Gx) - K 
A = GV + 4 



We have therefore 



°X<\ (v / G 2 s 2 +4-Gs 



(49) 
(50) 
(51) 



(52) 



The inequality ( p^ ) gives the maximum tolerable added 
noise for a reverse protocol to be secure. The correspond- 
ing limit is less stringent for low s values, i.e. for strong 
squeezing. The more squeezing Alice uses, the more noise 
reverse cryptography can tolerate. 

Let us consider the case of a lossy transmission line 
with G < 1. The added noise is always bigger than a 
minimal value, Gx > (1 — G), this inequality being sat- 
urated if there is no excess noise (in that case the only 
added noise is vacuum noise). In that case where the 
noise is only due to losses, (|52|) becomes 



1-G< 



i(v^ 



4 - Gi 



(53) 



It is straightforward to check that this inequality holds 
for arbitrary high losses (G — > 0) , even for coherent states 
(s = 1). Therefore reverse reconciliation provides a sim- 
ple way to extend the coherent state protocols of ref. Q| 
into the high-loss regime. 
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IV. IMPLEMENTATIONS 

In this section we consider protocols with the same 
quantum communication part as in ref. ffl, but we as- 
sume that reverse reconciliation is used. The main ad- 
vantage is that the 3dB loss limit for security goes away 
as explained above. Here we give more quantitative esti- 
mates of the security thresholds. 



A. EPR vs coherent beams 

If Alice uses EPR beams (or modulates a maximally 
squeezed beam), s = 1/V, but Alice and Bob have infor- 
mation only every second transmission, since they don't 
always choose the same measurement basis. 



1 



1 



ATePR = T logo o — X log? — (54) 

4 82 (G X + f) 2 2 Gx + f 

If the added noise only comes from losses, G < 1 and 
G\ = 1 — G. In that case equation (|5j) becomes 

A/ePRJosscs = \ l0g 2 " -Z^T Y\ ^ ( 55 ) 

& 1 - 0(1 — y) 

For coherent beams, no squeezing is used, therefore 
s = 1 and the mutual informations are not dependent of 
the basis choice. We have thus 

A/c0h ^ l0g2 (G X + G±)(G X + G) (56) 
AJ coh = A/epr - ^ log 2 G(l + x) (57) 

Since G\ > (1 — G), with the equality iff the noise is 
minimal and G < 1, we obtain 



AL nh < Al 



EPR, 



(58) 



both secret rates being equal if and only if the noise comes 
only from losses. As in jD, squeezing does not improve 
the secret rate for losses only, but this is no more true in 
presence of excess noise. 



our reversed continuous variable protocols, but the order 
of magnitude is the same (for strong losses) . 

Taking for instance a 100 km line with 20 dB loss 
(G = 0.01) and a reasonable modulation (V ~ 10), the 
secret key rate is 6.5 • 10 -3 bit/symbol. For the same pa- 
rameters, the secret key rate for QDV QKD with an ideal 
single photon source would be at best 5 • 10 -3 bit/time 
slot, and would be one order of magnitude smaller us- 
ing attenuated light pulses with n — 0.1, even with per- 
fect detectors. Actually it is zero with state-of-the-art 
QDV systems at 1550 nm. It is also noticeable that with 
a "symbol rate" of a few MHz that should be easy to 
achieve, the QCV secret key rate after 100 km is more 
than 10 kbits/sec, while it is simply zero for QDV. 

More realistically, one should take into account possi- 
ble excess noise in the line. Defining the excess noise as 
e = x ~ (1 — G)/G, it is simple to show that the reverse 
protocols are secure as long as as e < (V — 1)/ (2V) ^1/2 
for coherent states, and e < (V — l)/V ~ 1 for EPR 
beams. This shows again that it is possible to use coher- 
ent states, though EPR beams are more robust indeed. 



V. CONCLUSION 

In this paper we have shown that reverse reconciliation 
protocols can be used to extract a secret key from the 
exchange of coherent, squeezed or EPR beams between 
Alice and Bob. The key is secure against individual at- 
tacks for any transmission of the optical line between Al- 
ice and Bob, provided that the excess noise (noise beyond 
the loss-induced vacuum noise) is not too large. 

Squeezing makes these protocols more robust against 
the excess noise, but it is not absolutely required. It can 
be shown || that reverse reconciliation is optimum for 
a coherent states protocol with no excess noise in the 
transmission line, but this is not always the case : for 
instance, direct reconciliation may be better for high line 
transmission and large excess noise. It may therefore be 
possible to optimize further the secret bit rate by using 
two- ways reconciliation protocols. 



B. Strong losses 

Assuming strong losses, G <C 1, no excess noise, and a 
large initial modulation, eqs. ^5] and |5^ become 



AL 



EPR .losses 



AL 



coh, losses 



G 
21n2' 



(59) 



This secret rate can be compared with BB84's rate, which 
is ^Gn, with n — 1 for single photons and n < 1 for 
weak coherent pulses. Even if BB84 uses two modes of 
the electromagnetic field, it is slightly less efficient than 
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